From Actions to Obligations:
A Deontic Action Model Logic
May 26, 2026
We introduce the Deontic Action Model Logic (DAML), a dynamic modal framework for reasoning about obligations over actions in multi-agent systems. DAML extends the epistemic Action Model Logic by incorporating deontic evaluation mechanisms that assess agents’ actions in terms of both the desirability and the likelihood of their outcomes. Obligations arise for those actions that maximize expected deontic value among an agent’s available alternatives at a given decision point, yielding a formal account for reasoning about conditional and context-sensitive obligations in settings involving strategic interaction and incomplete information. DAML supports principled action selection in norm-governed multi-agent systems, and is the first such framework to derive these obligations using the action model logic machinery. We provide an axiomatization of the logic and prove soundness and completeness with respect to its semantics. Finally, we demonstrate the expressive power of our framework through applications to the Miners’ Puzzle and other multi-agent deontic scenarios.
Deontic logic [1], [2] studies normative concepts such as obligations, permissions, and prohibitions, and has been widely applied in philosophy, legal theory, and computer science, in particular for the formal specification of normative and multi-agent systems. Formally, it extends propositional logic with modal operators expressing normative force, such as obligation (\(O\varphi\)), permission (\(P\varphi\)), and prohibition (\(F\varphi\)), often further enriched with conditional modalities \(O(\varphi\mid\psi)\) to capture context-dependent obligations.
There are two extensions of deontic logic that are relevant to our study. First, Seeing To It That (STIT) logic [3], [4] is a family of modal logics designed to formally represent agency, choice, and responsibility. Its central idea is to capture what it means for an agent to see to it that certain state of affairs holds. In particular, the deontic STIT framework is rooted in a utilitarian approach to choice-making [3] and is employed in multi-agent settings [5]. Second, dynamic deontic logics [6], [7] introduce dynamic operators to evaluate permissions and obligations in relation to agents’ actions. Crucially, however, these frameworks do not explicitly incorporate epistemic considerations.
Epistemic logic (EL) [8], [9] provides a systematic method for representing and reasoning about epistemic states, i.e., what agents know, believe, or consider possible, and has been wildly successful in a number of different areas, such as computer science, economics, philosophy and game theory. Dynamic epistemic logic (DEL) [10], [11] extends EL with epistemic updates, such as public announcements, private observations and other complex epistemic actions. Perhaps the most well-known of these logics is public announcement logic (PAL) formulated by Plaza [10], wherein an announcement of a true proposition \(\varphi\) eliminates all possible worlds incompatible with it, thereby refining the epistemic model. Subsequent generalizations [12], led to the formulation of action model logic (AML), which captures a broader class of epistemic actions beyond public announcements, including private and semi-private information updates.
With a few notable exceptions [13], [14], systematic interactions between epistemic and deontic frameworks remain limited. Nevertheless, many deontic problems crucially rely on an underlying epistemic framework or, at the very least, involve some degree of uncertainty. A well-known example is the Miners’ Puzzle:
Example 1 (Miners’ Puzzle [15]). Ten miners are trapped either in shaft A or in shaft B, but we do not know which. Flood waters threaten to flood the shafts. We have enough sandbags to block one shaft, but not both. If we block one shaft, all the water will go into the other shaft, killing any miners inside it. If we block neither shaft, both shafts will fill halfway with water, and just one miner, the lowest in the shaft, will be killed.
The goal of this paper is to provide a combined framework, where the epistemic effects of agent’s actions are evaluated, providing, in turn, obligations towards the actions that maximize an expectation function.
An argument for a “Bayesian” semantics of deontic modalities has been proposed by Lassiter [16], [17]. The core idea is that deontic modals have a semantical structure that is scalable, and that deontic scales are formally identical to the expected utility scales used in Bayesian decision theory, with the difference that the function assigns an expected moral value instead of a personal utility. The expectation function is computed by (i) assigning a value \(V(w)\) to each possible world \(w\in W\) in a model, representing how morally or practically desirable it would be if all of the facts of the world were arranged as in \(w\); and (ii) by using a probability measure \(P\), representing how likely a given possible world is. From (i) and (ii), [16] argues that the expected moral value of a proposition in a set of worlds can be evaluated by the the average value of the worlds where the proposition is true:
\[\mathbb{E}(\varphi) = \sum_{w \in \llbracket\varphi\rrbracket} V(w) \times P(\{w\}|\varphi)\]
Where \(\llbracket\varphi\rrbracket\) is the truth set of that formula, i.e., the set of worlds where \(\varphi\) holds.
We endorse this idea and we provide a possible-world semantics accounting for the expected moral value framework proposed by [16].
Main contributions:
Inspired by Lassiter [16], we model deontic statements in a scalar way, by assigning to each world in a Kripke model a desirability value that we use to compute an expected deontic value of a model (or a portion thereof).
Following the dynamic deontic logic’s approach [6], [7], we treat actions as first class citizens of deontic statements and we employ the Action Model Logic (AML) machinery [12] to formally reason about the epistemic consequences of agents’ actions in order to compare their resulting outcomes. More concretely, the kind of questions that we aim at answering are: "If agent \(i\) were to perform action \(\alpha_i\), would the resulting outcome be more desirable than that obtained by performing action \(\beta_i\)?"
We introduce a new binary deontic modality \(O_i(\alpha_i|\varphi)\) that reads as "agent \(i\) ought to perform action \(\alpha_i\) under condition \(\varphi\)". Its truthfulness depends both on (i) \(\varphi\) holding after action \(\alpha_i\), and (ii) action \(\alpha_i\) leading to the outcome with the highest expected deontic value. In particular, \(O_i(\alpha_i|\varphi)\) adheres to the STIT principle [3]: agent \(i\) sees to it that the best expected outcome is obtained, meaning that she ought to perform action \(\alpha_i\) under the assumption that \(\varphi\).
We prove the soundness and completeness of the resulting proof system of the logic and we illustrate its usefulness with some examples.
The resulting Deontic Action Model Logic (DAML) provides a formal reasoning framework for agents that must select actions under epistemic uncertainty while taking normative constraints into account. By explicitly representing and comparing the expected deontic consequences of alternative actions, the logic supports principled decision-making in norm-governed multi-agent environments. In particular, an action is considered most desirable when it both (i) significantly reduces uncertainty and (ii) leads to normatively preferable consequences. Crucially, the framework also supports reasoning in intermediate cases where neither criterion is fully optimized, that is, under incomplete information.
Paper organization The rest of this paper is organized as follows: 2 introduces some preliminary definitions for our framework. The novel Deontic Action Model Logic DAML is presented in 3, and its soundness and completeness are shown in 4. 5 is dedicated to examples, including the famous Miner’s puzzle (5.1), and a more complex multi-agent scenario (5.2). Finally, some conclusions are offered in 6.
In this section, we elaborate some preliminary concepts and definitions of our novel DAML. We assume a finite non-empty set of agents \(\Pi= \{i,j,\ldots \}\) and a fixed non-empty set of possible actions \(\alpha_i \in \mathcal{A}\), indexed by agents in \(\Pi\) indicating the agent that can perform said action. While it is possible to create more complex actions using PDL [18], we only make use of action concatenation \(\alpha_i;\beta_i\), here representing the execution of action \(\alpha_i\) followed by \(\beta_i\). As standard in EL, we rely on Kripke models \(\mathcal{M}= \langle W, R_i, V \rangle\), where \(W \ne \varnothing\) is a non-empty set of possible worlds, called domain, \(R_i \subseteq 2^{W\times W}\) is a binary accessibility relation, one for each agent \(i \in \Pi\) and \(V : Prop \to 2^W\) is a valuation function that assigns to each atomic proposition \(p \in Prop\) a set of worlds \(V(p) \subseteq W\) where \(p\) holds. A pointed graded Kripke model is a pair \((\mathcal{M}, v)\) where \(\mathcal{M}\) is a Kripke model with \(v \in W\). We use \(R_i(v)\) to denote the set of all worlds that are \(i\)-accessible from \(v\).
Unless specified otherwise, this paper relies on S5 relations to model knowledge, i.e., where the accessibility relations are reflexive (\(uR_iu\)), transitive (if \(uR_i v\) and \(vR_i w\) then \(uR_i w\)) and euclidean (if \(uR_i v\) and \(uR_i w\) then \(vR_i w\)).
We continue with some introductory definitions, closely following [11], with the distinction that we use agent-indexed actions \(\alpha_i\).
Definition 1 (Pointed action model). An action model* is a triple \(U = \langle E, Q_i, pre \rangle\) where \(E \ne \varnothing\) is a finite set of action points, each indexed by an agent, \(Q_i \subseteq 2^{E\times E}\) is a binary accessibility relation, one for each agent and the precondition function \(pre: E \rightarrow \mathcal{L}\) assigns the precondition \(pre(\beta_i)\in \mathcal{L}\) that is necessary for an event \(\beta_i \in E\) to happen.1 A pointed action model is a pair \((U,\alpha_i)\) with \(\alpha_i \in E\).*
An action model simulates the results of an epistemic action in a Kripke model via the product update operation:
Definition 2 (Product update). The (restricted modal) product update* of a Kripke model \(\mathcal{M}= \langle W,R_i,V \rangle\) with an action model \(U = \langle E, Q_i, pre \rangle\) is a Kripke model \(\mathcal{M}\otimes U := \langle S',R_i',V' \rangle\) where:*
\(W' := \{(v, \beta_i) \in W \times E \mid \mathcal{M}, v \vDash pre(\beta_i) \}\),
\(R_i' := \{\bigl((v, \beta_i),(u, \gamma_i)\bigr)\in W'\times W' \mid (v, u) \in R_i\) and \((\beta_i, \gamma_i) \in Q_i\}\),
\(V'(p) := \{(v, \beta_i) \in W' \mid v \in V(p)\}\).
If \(W' = \varnothing\), the product update is undefined.
Intuitively, the result of a product update is a Kripke model that preserves those worlds that satisfy the preconditions of the actions. Their epistemic effects can be evaluated in the semantics: \(\mathcal{M}, w \vDash [U,\alpha_i]\varphi\), iff \(\mathcal{M},w \vDash pre(\alpha_i)\) implies \(\mathcal{M}\otimes U, (w,\alpha_i) \vDash \varphi\) [11]. 1 shows the axiomatic system of AML. We adopted the definition in [11] using our notation. In particular, the action model composition operation \(U \circ U'\) represents the effects of applying consecutive action models with a single combined update model [11]:
Definition 3 (Action model composition). Given two action models \(U =(E, Q_i, pre)\) and \(U'=(E', Q', pre')\), their composition \(U\circ U'=(E'', Q_i'', pre'')\) is defined as: \(E''=E\times E'\), \((\alpha_i;\alpha'_i) Q_i'' (\beta_i;\beta'_i)\) iff \(\alpha_i Q_i \beta_i\) and \(\alpha'_i Q'_i \beta'_i\), and \(pre''(\alpha_i;\alpha'_i)= \langle U,\alpha_i\rangle pre'(\alpha'_i)\).
| Taut | All instantiations of propositional tautologies |
| S5. | Axioms of S5 modal logic |
| AM1. | \([ U,\alpha_i] p \leftrightarrow (pre(\alpha_i) \rightarrow p)\) |
| AM2. | \([ U,\alpha_i]\neg \varphi \leftrightarrow (pre(\alpha_i) \rightarrow \neg[ U,\alpha_i] \varphi)\) |
| AM3. | \([ U,\alpha_i] (\varphi \wedge \theta) \leftrightarrow ([ U,\alpha_i]\varphi \wedge[ U,\alpha_i]\theta)\) |
| AM4. | \([ U,\alpha_i] K_i \varphi \leftrightarrow (pre(\alpha_i) \rightarrow \bigwedge_{\alpha_i Q_i \beta_i} K_i [ U,\alpha_i]\varphi)\) |
| AM5. | \([ U,\alpha_i][ U',\beta_i] \varphi \leftrightarrow[U\circ U',\alpha_i;\beta_i] \varphi\) |
In our framework, deontic statements are evaluated by comparing the results of different actions for different agents. Thus, we need to introduce expectation functions that range over only a portion of the model, based on (i) agent’s accessibility relation and (ii) models generated by actions. The following definitions are meant to capture exactly these features, through the notion of deontic expectation function and the various notions of submodels introduced below.
Following the ideas in [16], we first introduce a desirability function \(f: W \to \mathbb{N}\), which assigns natural numbers to possible worlds, representing their deontic desirability. We call a Kripke model equipped with a desirability function a graded Kripke model \(\mathcal{M}= \langle W, R_i, V,f \rangle\).2 As argued by [16], each deontic value \(f(w)\) is meaningful only in relation to the deontic value of the other worlds \(f(u)\). In particular, a product update between a graded Kripke model and an action model leaves the desirability function unchanged: given \(\mathcal{M}=\langle W,R_i,V,f\rangle\), \(\mathcal{M}\otimes U = \langle W',R_i',V',f' \rangle\) is such that \(f'(w,\alpha_i) = f(w)\).
Graded Kripke models allow to use an agent-based expectation function on models, that we label deontic expectation function:
Definition 4 (Deontic expectation function). Given an agent \(i \in \Pi\) and a pointed Kripke model \((\mathcal{M},v)\), \(i\)’s expectation function on that model \(\mathbb{E}_i(\mathcal{M})\) is defined as follows:
\[\mathbb{E}_i(\mathcal{M}) := \sum_{w \in W} f(w) \times \frac{1}{|R_i(v)|}\]
Intuitively, under the assumption that each possible world is equally possible3, the deontic expectation function of an agent \(i\) on a model \(\mathcal{M}\) weights an average of the value \(f(w)\) for all worlds \(w \in W\) that are accessible to that agent from a given world \(v \in W\).4 We call the value assumed by the deontic expectation function expected deontic value.
The deontic evaluation function can also be applied to only portions of a Kripke model, for which we use the notion of submodel:5
Definition 5 (Submodel). Let \((\mathcal{M},v)\) be a pointed model such that \(R_i(v) \ne \varnothing\). The submodel* of \(\mathcal{M}\) constructed from \(v\) is the Kripke model \(\mathcal{M}^v := \langle W', R_i', V'\rangle\) such that:*
\(W'\subseteq W\) is the set of all worlds \(u\) such that \(v R_{i_0} u_1 R_{i_1} u_2 R_{i_2} \dots u_{k}R_{i_k} u\) for some \(k\geq 0\), with worlds \(u_1,\dots,u_{k} \in W\) and agents \(i_0,\dots, i_k \in \Pi\);
\(R_i' := R_i \cap (W' \times W')\) for each \(i \in \Pi\);
\(V'(p) := V(p)\cap W'\) for each \(p \in Prop\);
We call agent-based submodel* a submodel constructed using accessibility relations of a single agent \(i \in \Pi\) from a given point \(v \in W\), labeled \(\mathcal{M}_i^v\).*
Since every submodel of a Kripke model is a Kripke model, the deontic expectation function can be formulated analogously for agent-based submodels \(\mathcal{M}_i^v\), written \(\mathbb{E}_i(\mathcal{M}_i^v)\). Similar considerations can be extended to Kripke models resulting from product updates. We call the submodels of these Kripke models action-generated submodels:
Definition 6 (Action-generated submodel). Given a graded Kripke model \(\mathcal{M}\otimes U = \langle W, R_i, V . f\rangle\) obtained via the product update operation between a graded pointed Kripke model \((\mathcal{M},v)\) and an action model \(U= \langle E, Q_i, pre\rangle\) its action generated submodels* are the Kripke models \(\mathcal{M}^{v,\alpha_i} = \langle W^{\alpha_i}, R^{\alpha_i}, V^{\alpha_i} f^{\alpha_i}\rangle\) such that:*
\(W^{\alpha_i} \subseteq W\) is the set of all worlds \((u,\alpha_i)\) such that \((v,\alpha_i) R^{\alpha_i}_{i_0} (u_1,,\alpha_i) R^{\alpha_i}_{i_1} (u_2,\alpha_i) \\ R^{\alpha_i}_{i_2} \dots (u_{k},\alpha_i) R^{\alpha_i}_{i_k} (u,\alpha_i)\) for some \(k\geq 0\), worlds \((u_1,\alpha_i),\dots,(u_{k},\alpha_i) \in W\), and agents \(i_0,\dots, i_k \in \Pi\);
\(R_i^{\alpha_i} := R_i \cap (W^{\alpha_i} \times W^{\alpha_i})\) for each \(i \in \Pi\);
\(V^{\alpha_i}(p) := V(p)\cap W^{\alpha_i}\) for each \(p \in Prop\);
\(f^{\alpha_i} = f\)
For all actions \(\alpha_i\in E\). We call agent-based action-generated submodel* an action-generated submodel constructed using accessibility relations of a single agent \(i \in \Pi\) from a given point \((v,\alpha_i) \in W\), labeled \(\mathcal{M}_i^{v,\alpha_i}\).*
The notation \(\mathcal{M}^{w,\alpha_i}_i\) indicates the agent based action generated submodel of the Kripke model \(\mathcal{M}\otimes U\), which is not pointed. The superscript \(w,\alpha_i\) denotes the point from which the submodel is constructed, but is not itself necessarily the point of evaluation. To make that explicit we write \(\mathcal{M}^{w,\alpha_i}_i, (w,\alpha_i)\).
Agent-based action generated submodels are crucial in our framework to evaluate deontic statements, for which we formulate a corresponding deontic expectation function:
Definition 7 (Deontic expectation function for agent-based action generated submodels). Given an agent \(i \in \Pi\) and a graded Kripke model \(\mathcal{M}\otimes U = \langle W, R_i, V, f\rangle\) obtained via the product update with \(U= \langle E, Q_i, pre\rangle\) such that \(\alpha_i \in E\), we define the deontic expectation function for any of its agent-based action generated submodels \(\mathcal{M}_i^{v,\alpha_i} = \langle W^{\alpha_i}, R_i^{\alpha_i}, V^{\alpha_i} ,f^{\alpha_i} \rangle\) as follows:
\[\mathbb{E}_i(\mathcal{M}^{v,\alpha_i}_i) := \sum_{(w,\alpha_i) \in W^{\alpha_i}} f^{ \alpha_i}(w, \alpha_i) \times \frac{1}{|R_i^{\alpha_i}(v,\alpha_i)|}\]
Before moving to the definitions of the language and the semantics of DAML, we state some important remarks:
Considering the deontic expectation function of submodels generated by actions is particularly convenient in our framework, as we usually assume our action models to be only reflexive, meaning that the actions \(\alpha_i \in E\) are distinguishable from each other, at least for the acting agent. This reflects the fact that the acting agent knows the results of the different actions that she can perform. A single-agent example of such action model is provided in 1 (top right).
In the following, we impose some important restrictions on our action models. First, each action model \(U=\langle E, Q_i, pre\rangle\) expresses a set of actions available to a single agent \(i\) at a given point of the system evolution, that we call decision point. In particular, each decision point \(U\) consists of at least two actions \(|E| \geq 2\). We also assume that none of the actions at a given decision point leads to an empty (sub)model, i.e., the agents maintain consistency through their actions. As we use action models to simulate the consequences of agent’s actions, we do not use pointed action models. In this sense, our action models are closer to multi-pointed action models [21], wherein one considers a set of actions instead of a single point. Considering synchronous and parallel actions of agents is outside the scope of the current work.
In this section, we introduce the main definitions of DAML. The final ingredient for our logic is a set of expectation atoms \(\varepsilon = \{ e^{\alpha_i}_i, e^{\beta_j}_j \ldots \}\) expressing the highest expected deontic value of action-generated submodels, where \(e^{\alpha_i}_i\) stands for \(i\)’s expected deontic value of the submodel generated by the action \(\alpha_i\), at a given decision point, i.e., \(\mathbb{E}_i(\mathcal{M}^{w,\alpha_i}_i)\).
We can now introduce the language of DAML:
Definition 8 (Language). The language \(\mathcal{L}^{DAML}\) is defined by the following grammar: \[\varphi ::= \;p \;| \; e^{\alpha_i}_i \;| \;\neg\varphi \;| \; (\varphi \wedge \varphi) \;| \;K_i \varphi \;| \;\langle U,\alpha_i\rangle\varphi \;| \;O_i( U,\alpha_i| \varphi)\]
With \(p \in Prop\), \(e^{\alpha_i}_i \in \varepsilon\) and \(\alpha_i \in \mathcal{A}\). We use standard propositional abbreviations, \(\bot := p \wedge \neg p\), \(\top := \neg \bot\), \(\hat{K}_i\varphi := \neg K_i\neg \varphi\) and \([ U,\alpha_i] \varphi := \neg \langle U,\alpha_i\rangle\neg \varphi\). We denote with \(\mathcal{L}\) the fragment of \(\mathcal{L}^{DAML}\) without the new modal operator \(O_i( U,\alpha_i | \varphi)\).
The two new elements that are added to the language of AML are the expectation atoms \(e^{\alpha_i}_i\) and the novel modality \(O_i ( U,\alpha_i|\varphi)\), which reads as "agent \(i\) ought to perform action \(\alpha_i\) under the assumption that \(\varphi\)". Their meaning is captured by the following semantics:
Definition 9 (Semantics of \(\mathcal{L}^{DAML}\)). Given a graded pointed Kripke model \((\mathcal{M},v) = (\langle W, R_i, V ,f\rangle,v)\) with \(v,w \in W\), a pointed action model \((U,\alpha_i) = (\langle E, Q_i, pre\rangle, \alpha_i)\), with \(\alpha_i, \beta_i \in E\), the agent submodel \(\mathcal{M}^v_i\) of \((\mathcal{M},v)\) and the agent-based action generated submodel \(\mathcal{M}^{(v,\alpha_i)}_i\) of \(\mathcal{M}\otimes U, (v, \alpha_i)\) we define the following semantics:
\(\mathcal{M}, w \vDash p \text{ iff } w \in V(p)\)
\(\mathcal{M}^{w,\alpha_i}_i ,(w,\alpha_i) \vDash e^{\alpha_i}_i \text{ iff } \mathbb{E}_i(\mathcal{M}^{w,\alpha_i}_i) \geq \mathbb{E}_i(\mathcal{M}^{w,\beta_i}_i)\) for all \((w,\alpha_i) \in W^{\alpha_i} \ne (w,\beta_i) \in W^{\beta_i}\) 6
\(\mathcal{M}, w \vDash\neg \varphi \text{ iff } \mathcal{M}, w \not\vDash\varphi\)
\(\mathcal{M}, w \vDash(\varphi \wedge \psi) \text{ iff }\mathcal{M}, w \vDash\varphi \text{ and } \mathcal{M}, w \vDash\psi\)
\(\mathcal{M}, w \vDash K_i\varphi \text{ iff } \mathcal{M}, w \vDash\varphi \text{ for all } w'\in W \text{ s.t. } w' \in R_i(w)\)
\(\mathcal{M}, w \vDash\langle U,\alpha_i \rangle \varphi\) iff \(\mathcal{M}, w \vDash pre(\alpha_i)\) and \(\mathcal{M}\otimes U, (w,\alpha_i) \vDash\varphi\), where \(\mathcal{M}\otimes U := \langle W',R_i',V' \rangle\) is defined in 2;
\(\mathcal{M}_i^w ,w \vDash O_i ( U,\alpha_i|\varphi)\) iff \(\mathcal{M}_i^w, w \vDash\langle U,\alpha_i \rangle \varphi\) and \(\mathcal{M}_i^{w,\alpha_i} ,(w,\alpha_i) \vDash e^{\alpha_i}_i\)
In particular, \(\mathcal{M}\otimes U\) is defined whenever \(\mathcal{M}\vDash\langle U,\alpha_i \rangle \varphi\) is. We say that \(\mathcal{M}_i^v \vDash\varphi\) holds if, for all \(w \in W\), \(\mathcal{M}_i^v,w \vDash\varphi\). Given a class of models \(C\), we say that \(\varphi\) is valid in the class of models \(C\) iff \(\mathcal{M}\vDash\varphi\) for all \(\mathcal{M}\in C\).
Intuitively, expectation atoms are true if and only if the expected deontic value for \(i\) for that action-generated submodel is greater or equal the expected deontic value of the other action-generated submodels at that decision point.7
The new modality \(O_i ( U,\alpha_i|\varphi)\) is true if and only if (i) \(\varphi\) is true after action \(\alpha_i\), and (ii) action \(\alpha_i\) leads to the action generated submodel whose expected deontic value is greater or equal the expected deontic value of the submodels generated via other actions at that decision point.8 In particular, expectation atoms hold globally in a submodel, that is, they are true in every world of an agent-based action generated submodel. This is because their truth depends on expectation functions which range over submodels. Consequently, also ought formulas are true (or false) in every world, as their truth depends on the truth of the corresponding expectation atoms. For this reason in the rest of the paper we will omit the evaluation world for these formulas, writing \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) and \(\mathcal{M}_i^v \vDash O_i (U,\alpha_i|\varphi)\).
The core idea is that we interpret the ought modality with an intrinsic STIT component: agent \(i\) sees to it that the highest expected outcome is obtained, and hence ought to perform action \(\alpha_i\), under the assumption that \(\varphi\).
At the same time, in the truth conditions for the modality \(O_i( U,\alpha_i | \varphi)\), \(\langle U,\alpha_i \rangle \varphi\) is evaluated in the pointed model \(\mathcal{M}_i^v,v\) constructed from \(v\).
Taken together, these features make DAML a framework that models agents’ hypothetical reasoning, allowing them to evaluate the consequences of alternative actions at a decision point prior to execution and to select those actions that lead to the most desirable outcomes given their current informational state.
In the next section we prove soundness and completeness of DAML.
The main goal of this section is to prove that the language \(\mathcal{L}^{DAML}\) can be reduced to the language \(\mathcal{L}\) which does not contain deontic operators, and for which completeness is well known [11]. Technically, \(\mathcal{L}\) differs from the standard language of AML as it contains expectation atoms \(e_i^\alpha\). However, this does not constitute a problem for our reduction: since the completeness of AML depends on the completeness of EL via reduction, adding a set of atoms (like \(e_i^\alpha\)) to EL does not alter its completeness, which in turn does not alter the completeness of AML. In addition, we avoid potential circularity by restricting the preconditions used in our action models to formulas solely from the language of AML, as per 1.
Our goal is to formulate reduction axioms showing that for every formula with a deontic operator there exist a translation of that formula without that operator, without altering its meaning. Before that, we introduce the following elementary lemma used in later proofs:
lemma1
For any agent \(i\) and corresponding action \(\alpha_i\):
\(\mathcal{M}_i^{v,\alpha_i} \vDash e^{\alpha_i}_i \leftrightarrow K_i e^{\alpha_i}_i\);
\(\mathcal{M}_i^v \vDash O_i( U,\alpha_i|\varphi) \leftrightarrow K_i O_i( U,\alpha_i|\varphi)\)
Proof. \((\Rightarrow)\) (i) Since \(\mathcal{M}_i^{v,\alpha_i} \vDash e^{\alpha_i}_i\), then for all \((w,\alpha_i) \in W\), \(\mathcal{M}_i^{v,\alpha_i}, (w,\alpha_i) \vDash e^{\alpha_i}_i\), making \(K_i e^{\alpha_i}_i\) true. (ii) is proven analogously.
\((\Leftarrow)\) (i) and (ii) follow from axiom T of \(K_i\). ◻
We can now introduce the axiomatic system of DAML, which extends the axiom system of AML [11] with the following axioms for the new expectation atoms and the novel deontic modality:
Definition 10 (Axioms of DAML). For \(i \in \Pi\), \(\alpha_i, \beta_i \in \mathcal{A}\), \(p \in Prop\), \(\varphi,\psi \in \mathcal{L}^{DAML}\) and \(e^{\alpha_i}_i \in \varepsilon\), the axiomatic system of DAML is shown in 2. We write \(DAML \vdash \varphi\) to indicate that \(\varphi\) is derivable in DAML.
| AML | Axioms of AML (1) |
| E1 | \(\bigvee_{i \in \Pi}e^{\alpha_i}_i\) |
| E2 | \(e^{\alpha_i}_i \rightarrow K_i e^{\alpha_i}_i\) |
| R1 | \(O_i( U,\alpha_i|p) \leftrightarrow pre(\alpha_i) \wedge p \wedge e^{\alpha_i}_i\) |
| R2 | \(O_i( U,\alpha_i|\varphi \wedge \psi) \leftrightarrow O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi)\) |
| R3 | \(O_i( U,\alpha_i|\neg \varphi) \leftrightarrow pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi)\) |
| R4 | \(O_i( U,\alpha_i|K_i\varphi) \leftrightarrow K_i O_i( U,\alpha_i|\varphi)\) |
| R5 | \(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi) \leftrightarrow \langle U\circ U',\alpha_i;\beta_i\rangle\varphi \wedge e^{\alpha_i}_i\) |
| R6 | \(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi)) \leftrightarrow O_i(U\circ U',\alpha_i;\beta_i|\varphi) \wedge e^{\alpha_i}_i\) |
In particular, axioms E1 and E2 express properties of the expectation atoms. E1 states that at least one expectation atom holds for each agent. E2 states that if an expectation atom is true it is also known. R1-R6 are reduction axioms. We begin by showing soundness of the axiomatic system.
theoremS The axiomatic system of 10 is sound.
Proof. Soundness for axioms of epistemic logic and of reduction axioms of AML is standard [11]. Here we prove soundness of the newly introduced axioms E1-E2 and of the reduction axioms R1-R6:
\(\bigvee_{i \in \Pi}e^{\alpha_i}_i\): easily follows from the semantics of \(e^{\alpha_i}_i\) (9), and the fact that \(\mathcal{A}\ne \varnothing\) and \(E \ne \varnothing\).
\(e^{\alpha_i}_i \rightarrow K_i e^{\alpha_i}_i\): follows from [lemma:glob].
\(O_i( U,\alpha_i|p) \leftrightarrow (pre(\alpha_i) \wedge p) \wedge e^{\alpha}_i\) :
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i \rangle p \text{ and } \mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (semantics of \(O_i\))
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i)\) and \(\mathcal{M}_i^{v,\alpha_i},(v,\alpha_i) \vDash p\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (axioms of AML).
\(O_i( U,\alpha_i|\neg \varphi) \leftrightarrow (pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi))\):
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i \rangle \neg \varphi \text{ and } \mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\(\mathcal{M}_i^v,v \vDash(pre(\alpha_i) \wedge \neg \langle U,\alpha_i \rangle \varphi) \text{ and } \mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (axioms of AML)
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi)\) (sem. of \(O_i\), prop. reasoning)
\(O_i( U,\alpha_i|\varphi \wedge \psi) \leftrightarrow O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi)\):
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i \rangle \varphi \wedge \langle U,\alpha_i \rangle \psi \text{ and } \mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\((\mathcal{M}_i^v,v \vDash\langle U,\alpha_i \rangle \varphi\) and \(\mathcal{M}^{v,\alpha_i}_i, \vDash e^{\alpha}_i) \wedge (\mathcal{M}_i^v,v \vDash\langle U, \alpha_i \rangle \psi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i)\) (taut., prop. reasoning)
\(\mathcal{M}_i^v \vDash O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi)\) (sem. of \(O_i\))
\(O_i( U,\alpha_i|K_i\varphi) \leftrightarrow K_i O_i( U,\alpha_i|\varphi)\):
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i \rangle K_i\varphi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\(\mathcal{M}_i^v,v \vDash K_i \langle U,\alpha_i \rangle \varphi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash K_i(e^{\alpha_i}_i)\) (axioms of AML, [lemma:glob])
\(\mathcal{M}_i^v \vDash K_i O_i( U,\alpha_i|\varphi)\) (property of \(K_i\), sem. of \(O_i\)).
\(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi) \leftrightarrow \langle U\circ U', \alpha_i;\beta_i\rangle\varphi \wedge e^{\alpha_i}_i\):
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i\rangle\langle U',\beta_i\rangle\varphi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i)\) and \(\mathcal{M}^{v,\alpha_i}_i, (v,\alpha_i) \vDash pre(\beta_i)\) and \(\mathcal{M}^{v,\alpha_i;\beta_i}_i, (v,\alpha_i;\beta_i) \vDash\varphi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(\langle U,\alpha_i\rangle\))
\(\mathcal{M}_i^v,v \vDash\langle U\circ U',\alpha_i;\beta_i\rangle\varphi\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (def. of \(\langle U,\alpha_i \rangle\), 3.)
\(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi)) \leftrightarrow O_i(U\circ U',\alpha_i;\beta_i|\varphi) \wedge e^{\alpha_i}_i\):
\(\mathcal{M}_i^v,v \vDash\langle U,\alpha_i\rangle O_i( U',\beta_i|\varphi)\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i)\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash O_i( U,\beta_i|\varphi)\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(\langle U,\alpha_i\rangle\))
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i)\) and \(\mathcal{M}^{v,\alpha_i}_i, (v,\alpha_i) \vDash\langle U,\beta_i\rangle\varphi\) and \(\mathcal{M}^{v,(\alpha_i;\beta_i)}_i \vDash e^{\alpha_i;\beta_i}_i\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\))
\(\mathcal{M}_i^v,v \vDash pre(\alpha_i)\) and \(\mathcal{M}^{v,\alpha_i}_i, (v,\alpha_i) \vDash pre(\beta_i)\) and \(\mathcal{M}^{v,(\alpha_i;\beta_i)}_i, (v,(\alpha_i;\beta_i)) \vDash\varphi\) and \(\mathcal{M}^{v,(\alpha_i;\beta_i)}_i \vDash e^{\alpha_i;\beta_i}_i\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(\langle U,\alpha_i\rangle\))
\(\mathcal{M}_i^v \vDash O_i(U\circ U',\alpha_i;\beta_i|\varphi)\) and \(\mathcal{M}^{v,\alpha_i}_i \vDash e^{\alpha_i}_i\) (sem. of \(O_i\), ,3.)
◻
We can now move to the completeness proof, for which we introduce the following definitions:
Definition 11 (Translation). The translation \(t: \mathcal{L}^{DAML} \rightarrow \mathcal{L}\) is defined as follows:
2
\(t(p)=p\)
\(t(e^{\alpha_i}_i) =e^{\alpha_i}_i\)
\(t(\neg \varphi)=\neg t(\varphi)\)
\(t(\varphi \wedge \psi) =t(\varphi)\wedge t(\psi)\)
\(t(K_i \varphi)= K_i t(\varphi)\)
\(t(\langle U,\alpha_i\rangle p)\)=
\(t( pre(\alpha_i)) \wedge p\)
\(t(\langle U,\alpha_i\rangle\neg \varphi)\)=
\(t(pre(\alpha_i) \wedge \neg \langle U,\alpha_i\rangle \varphi)\)
\(t(\langle U,\alpha_i\rangle (\varphi \wedge \psi))\)=
\(t(\langle U,\alpha_i\rangle\varphi \wedge \langle U,\alpha_i\rangle\psi)\)
\(t(\langle U,\alpha_i\rangle K_i \varphi)\)=
\(t(pre(\alpha_i) \wedge K_i \varphi)\)
\(t(\langle U,\alpha_i\rangle \langle U',\beta_i\rangle \varphi)\)=
\(t(\langle U\circ U',\alpha_i;\beta_i\rangle \varphi)\)
\(t (O_i( U,\alpha_i|p))\)=
\(t(pre(\alpha_i) \wedge p \wedge e^{\alpha_i}_i)\)
\(t(O_i( U,\alpha_i|\neg \varphi))\)=
\(t(pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi))\)
\(t(O_i( U,\alpha_i|\varphi \wedge \psi))\)=
\(t(O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi))\)
\(t(O_i(\alpha_i|K_i\varphi))\)= \(t(K_i O_i( U,\alpha_i|\varphi))\)
\(t(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi))\)= \(t(\langle U\circ U',\alpha_i;\beta_i\rangle\varphi \wedge e^{\alpha_i}_i)\)
\(t(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi)))\)= \(t(O_i(U\circ U',\alpha_i;\beta_i|\varphi) \wedge e^{\alpha_i}_i)\)
Definition 12 (Complexity measure). We define a complexity function \(c: \mathcal{L}^{DAML} \to \mathbb{N}\) by recursion on \(\varphi\):
\(c(p)=1\)
\(c(e^{\alpha_i}_i)=1\)
\(c(\neg \varphi)= 1 + c(\varphi)\)
\(c(\varphi \wedge \psi)= 1+ Max(c(\varphi),c(\psi))\)
\(c(K_{i} \varphi)=1 + c(\varphi)\)
\(c(\langle U,\alpha_i\rangle\varphi)= (4+c(pre(\alpha_i)) \cdot c(\varphi)\)
\(c (O_i( U,\alpha_i|\varphi))= (5+c(pre(\alpha_i)) \cdot c(\varphi)\)
It is easy to check that the complexity of any formula is strictly greater than the complexity of any proper sub-formula.
theoremT For every formula \(\varphi \in \mathcal{L}^{DAML}\), \(\vdash \varphi \leftrightarrow t(\varphi)\)
Proof. We first prove the following auxiliary lemma , showing that the complexity of the formula on the left is greater than the complexity of the reduced formula on the right:
Lemma 1. The following inequalities hold:
\(c (O_i( U,\alpha_i|p)) > c(pre(\alpha_i) \wedge p \wedge e^{\alpha_i}_i)\)
\(c(O_i( U,\alpha_i|\neg \varphi)) > c(pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi))\)
\(c(O_i( U,\alpha_i|\varphi \wedge \psi)) > c(O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi))\)
\(c(O_i( U,\alpha_i|K_i\varphi)) > c(K_i O_i( U,\alpha_i|\varphi))\)
\(c(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi)) > c(\langle U\circ U',\alpha_i;\beta_i\rangle\varphi \wedge e^{\alpha_i}_i)\)
\(c(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi))) > c(O_i(U\circ U',\alpha_i;\beta_i|\varphi) \wedge e^{\alpha_i}_i)\)
Proof.
\(c (O_i( U,\alpha_i|p)) > c(pre(\alpha_i) \wedge p \wedge e^{\alpha_i}_i)\)
\((5 + c(pre(\alpha_i))) \cdot c(p) > 1 + Max(pre(\alpha_i),c(p),c(e^{\alpha_i}_i))\)
\(c(O_i( U,\alpha_i|\neg \varphi)) > c(pre(\alpha_i) \wedge \neg O_i( U,\alpha_i|\varphi))\)
\((5+ c(pre(\alpha_i))) \cdot (1 + c(\varphi)) > 1 + Max(c(pre(\alpha_i)), (1+ (5+ c(pre(\alpha_i)) \cdot c(\varphi))))\)
\((5+ c(pre(\alpha_i))) \cdot (1 + c(\varphi)) > 1 + Max(c(pre(\alpha_i)), 6+ c(pre(\alpha_i))\cdot c(\varphi))\)
\(c(O_i( U,\alpha_i|\varphi \wedge \psi)) > c(O_i( U,\alpha_i|\varphi) \wedge O_i( U,\alpha_i|\psi))\)
\((5 + c(pre(\alpha_i))) \cdot (1 +Max( c(\psi), c(\varphi))) > 1 + Max((5+ c(pre(\alpha_i))) \cdot c(\varphi) , (5+ c(pre(\alpha_i))) \cdot c(\psi))\)
\(c(O_i( U,\alpha_i|K_i\varphi)) > c(K_i O_i( U,\alpha_i|\varphi))\)
\((5 + c(pre(\alpha_i))) \cdot (c(\varphi)+1) > 1 + ((5 + c(pre(\alpha_i))) \cdot c(\varphi))\)
\(c(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi)) > c(\langle U\circ U',\alpha_i;\beta_i\rangle\varphi \wedge e^{\alpha_i}_i)\)
\((5 + (c(pre(\alpha_i))) \cdot ((4+ c(pre(\beta_i))) \cdot c(\varphi))) > 1+ Max ((4+ c(pre(\alpha_i;\beta_i)) \cdot c(\varphi)), c(e^{\alpha_i}_i))\)
\((5 + (c(pre(\alpha_i))) \cdot ((4+ c(pre(\beta_i))) \cdot c(\varphi))) > 1+ Max ((4+ 1 + Max(c(pre(\alpha_i),c(pre(\beta_i)))) \cdot c(\varphi)), c(e^{\alpha_i}_i))\)
\(c(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi))) > c(O_i(U\circ U',\alpha_i;\beta_i|\varphi) \wedge e^{\alpha_i}_i)\)
\((5 + (c(pre(\alpha_i)))) \cdot ((5+ c(pre(\beta_i))) \cdot c(\varphi)) > 1+ Max ((5+ 1 +Max(c(pre(\alpha_i),c(pre(\beta_i)) ))) \cdot c(\varphi), c(e^{\alpha_i}_i))\)
◻
We can now move to the proof of [translation], which is by induction on \(c(\varphi)\). All cases that do not involve the new modality are standard [11]. Here we show only the new cases:
For \(O_i( U,\alpha_i|p)\): It follows from axiom R1 of 10, item 1 of 1, and the induction hypothesis.
For \(O_i( U,\alpha_i|\neg \varphi)\): It follows from axiom R2 of 10, item 2 of 1, and the induction hypothesis.
For \(O_i( U,\alpha_i|\varphi \wedge \psi)\): It follows from axiom R3 of 10, item 3 of 1, and the induction hypothesis.
For \(O_i( U,\alpha_i|K_i\varphi)\): It follows from axiom R4 of 10, item 4 of 1, and the induction hypothesis.
For \(O_i( U,\alpha_i|\langle U',\beta_i\rangle\varphi)\): It follows from axiom R5 of 10, item 5 of 1, and the induction hypothesis.
For \(O_i( U,\alpha_i|O_i( U',\beta_i|\varphi))\): It follows from axiom R6 of 10, item 6 of 1, and the induction hypothesis.
◻
Theorem 1 (Completeness). For every formula \(\varphi \in \mathcal{L}^{DAML}\)
\[\vDash\varphi \text{ implies } \vdash \varphi\]
Proof. Suppose \(\vDash\varphi\). Thus, \(\vDash t (\varphi)\) by the soundness of the proof system ([thm:soundness]) and \(\boldsymbol{DAML} \vdash \varphi \leftrightarrow t(\varphi)\) ([translation]). In particular \(t (\varphi)\) does not contain any deontic operator. Thus, \(AML \vdash t (\varphi)\), since the logic for \(\mathcal{L}\) is complete [11]. Consequently, \(\boldsymbol{DAML} \vdash t(\varphi)\). Since \(\boldsymbol{DAML} \vdash \varphi \leftrightarrow t (\varphi)\), \(\boldsymbol{DAML} \vdash \varphi\). ◻
In the next section, we illustrate the scope of our framework by modeling two examples, namely the miner’s puzzle and a multi-agent example.
In this section, we illustrate our framework’s ability in modeling the single-agent miner’s puzzle, and a more convoluted two-agents example with asymmetric information. Before moving to the examples, we make some important remarks:
DAML represents agents’ hypothetical reasoning about the consequences of their available actions and in evaluating which choices yield the most desirable overall outcomes. Accordingly, the Kripke models presented in this section are interpreted from the perspective of an agent simulating and comparing action outcomes before committing to a decision.
In our examples, the evaluation point of a Kripke model does not necessarily represent the actual world, as which world is actual depends on the action performed by the agent. In our framework, agents are not running experiments to discover which world is the actual world, as in standard epistemic logic, but rather they are simulating the potential effects of actions, in order to determine which one leads to the most desirable consequences.
Likewise, action models do not have an actual action being performed. They are all equally actual as part of a simulation. In addition, the precondition function of each action does not actually represent only the precondition for performing that action - rather it also represents its epistemic effects on the model. We kept the name precondition function in line with the existing literature.
We model the miner’s puzzle from the perspective of a single agent \(i\) deciding which shaft (if any) to block. Since in the single-agent case \(\mathcal{M}= \mathcal{M}_i\), we will omit the agent subscript on models.
The initial situation is depicted in 1 (top left). Each world corresponds to a possible outcome, with one variable indicating the position of the miners (shaft \(A\) or shaft \(B\)) and the other representing the number of lives that can be saved, which in this scenario also corresponds to the desirability value of each world: \(f(A \wedge 10)= 10, f(A \wedge 0)= 0\) and \(f(A \wedge 9)= 9\) and analogously for the worlds where \(B\) holds. We assume complete ignorance of agent \(i\) concerning the current state of affairs.
Agent \(i\) can perform three actions, as represented in the action model \(U\) of 1 (top right): Action \(\alpha_i\) (block shaft \(A\)) can save ten lives (if the miners are in the shaft \(A\)), or zero otherwise: \(pre(\alpha_i)= (A \wedge 10) \vee (B \wedge 0)\). Analogously for action \(\beta_i\) (block shaft \(B\)), \(pre(\beta_i)= (A \wedge 0) \vee (B \wedge 10)\). Blocking neither shaft (action \(\gamma_i\)) will ensure the saving of nine lives, independently of the location of the miners: \(pre(\gamma_i)=9\). None of the actions informs \(i\) about the actual location of the miners.
\(\mathcal{M}\otimes U\) 1 (below) is the result of \(i\)’s reasoning about the epistemic consequences of its available actions, and it consists of three disconnected action-generated submodels: \(\mathcal{M}^{\alpha_i}, \mathcal{M}^{\beta_i}, \mathcal{M}^{\gamma_i}\). Based on this results, we can evaluate deontic statements in the initial model. For example, we can check whether \(i\) ought to block shaft \(A\) given the current information, which amounts to check formula \(\mathcal{M}\vDash O_i ( U,\alpha_i|\top)\). By 9 it amounts to check the truth of the formula: \(\mathcal{M},v \vDash\langle U,\alpha_i \rangle \top \text{ and } \mathcal{M}^\alpha \vDash e^{\alpha_i}_i\). While the first conjunct is true, the second one is not: \(\mathcal{M}^\alpha \not \vDash e^{\alpha_i}_i\), as \(\mathbb{E}_i(\mathcal{M}^\gamma) > \mathbb{E}_i(\mathcal{M}^\alpha) = \mathbb{E}_i(\mathcal{M}^\beta)\). Thus, \(\mathcal{M}\not \vDash O_i ( U,\alpha_i|\top)\). Similarly, \(\mathcal{M}\not\vDash O_i ( U,\beta_i|\top)\). On the other hand, \(\mathcal{M}\vDash O_i ( U,\gamma_i|\top)\), meaning that for agent \(i\), given the current information, blocking neither shaft leads to the highest expected deontic value.
A patient \(p\) has condition \(C\) and is treated at the hospital where Alice (\(a\)) and Bethany (\(b\)) work. The condition can be treated with two drugs, \(d\) or \(d'\). Drug \(d\) has almost a \(100\%\) success rate for condition \(C\), unless an allergy is present, which makes it completely ineffective. Drug \(d'\), has a \(40\%\) success rate both for people who are allergic to \(d\), and for those who aren’t. It is up to \(a\) to administer the drug. \(p\) is allergic to drug \(d\), and \(a\) does not know that. On the other hand, \(b\) knows that \(p\) is allergic to the drug, and knows that \(a\) believes that \(b\) also does not know.
We model the example using two agents, \(a\) and \(b\), and we assume the viewpoint of the latter. The initial model is represented in 2 (left). Because of the asymmetry in agent’s knowledge, the model is KD45. Each world has two variables, one indicating the presence (resp. absence) of the allergy \(A\) (resp. \(\neg A\)) and one for which drugs is administered (\(d\) or \(d'\)). The desirability values correspond to the success rate of the treatment, abstracting away from other details. In particular, The top two worlds are accessible only to \(b\): she knows \(p\) has allergy \(A\). She also knows that \(a\) does not know, and that \(a\) believes that also \(b\) does not know, as represented by the four remaining worlds. The purpose of the modeling is to represent \(b\)’s hypothetical reasoning, simulating the effect of the combined actions available to both agents.
We use two action models, \(U\) and \(U'\), one decision point per agent. \(U\) 2 (top left) represents \(b\)’s choice between informing \(a\) of the allergy (action \(\delta_b\) with \(pre(\delta_b)= A\)) or simply doing nothing (action \(\gamma_b\) with \(pre(\gamma)=\top\)). \(U'\) 2 (bottom left) represents \(a\)’s choice between administering the drug \(d\) (action \(\alpha_i\) with \(pre(\alpha_a)= d\)) or \(d'\) (action \(\beta_i\) with \(pre(\beta_a)=d'\)).
\(\mathcal{M}\otimes U\) (3) represents the possible outcomes of \(b\)’s actions in its two action-generated submodels \(\mathcal{M}^{v,\delta_b}\) and \(\mathcal{M}^{v,\gamma_b}\).
\(\mathcal{M}\otimes U \otimes U'\) (4) represents the result of \(a\)’s possible actions executed after \(b\)’s possible actions, generating four action-generated submodels, from left to right \(\mathcal{M}^{w,(\delta_b;\alpha_a)}\), \(\mathcal{M}^{v,(\delta_b;\beta_a)}\), \(\mathcal{M}^{w,(\gamma_b;\alpha_a)}\) and \(\mathcal{M}^{v,(\gamma_b;\beta_a)}\). Each action-generated submodel represents the consequences of each combination of actions for the two agents9.
Based on these resulting submodels, it is possible compute agent’s obligations in the initial model. In particular, \(a\)’s expected deontic value for each action generated submodel is: \(\mathbb{E}_a(\mathcal{M}^{w,(\delta_b;\alpha_a)})= 0\), \(\mathbb{E}_a(\mathcal{M}^{v,(\delta_b;\beta_a)}) = \mathbb{E}_a(\mathcal{M}^{v,(\gamma_b;\beta_a)})\) \(= 40\), \(\mathbb{E}_a(\mathcal{M}^{w,(\gamma_b;\alpha_a)})= 50\). This means that the best possible outcome is where \(p\) is not allergic and drug \(d\) is administered. But this case is considered possible only by \(a\) in case she is not informed that \(p\) is allergic. From \(b\)’s perspective, \(\mathbb{E}_b(\mathcal{M}^{w,(\delta_b;\alpha_a)})= 0\), \(\mathbb{E}_b(\mathcal{M}^{v,(\delta_b;\beta_a)}) = \mathbb{E}_b(\mathcal{M}^{v,(\gamma_b;\beta_a)})\) \(= 40\), \(\mathbb{E}_b(\mathcal{M}^{w,(\gamma_b;\alpha_a)})= 0\), because she knows \(p\) is allergic. In particular, the expected deontic value of \(b\) is maximal whenever \(a\) administers \(d'\).
Also note that \(\mathcal{M}_b^v \vDash K_b O_a ( U',\beta_a|A)\), i.e., \(b\) knows that \(a\) should perform \(\beta_a\) if \(A\) were the case, and \(\mathcal{M}_b^v \vDash K_b O_a ( U',\alpha_a|\top)\), i.e., \(b\) knows that, without further information, \(a\) should instead perform \(\alpha_a\).
The goal of this modeling is to capture the fact that, if \(a\) knew that \(A\) (as \(b\) already does), \(a\) should perform \(\beta_a\), reason why \(b\) should perform \(\delta_b\). This statement can be expressed using the formula: \(\mathcal{M}_b^v \vDash O_b ( U,\delta_b | O_a ( U',\beta_a |K_aA))\). By semantic reasoning (9), we can unfold it in to the equivalent:
\(\mathcal{M}_b^v,v \vDash pre(\delta_b)\) and \(\mathcal{M}^{v,\delta_b}_b, (v,\delta_b) \vDash pre(\beta_a)\) and \(\mathcal{M}^{v,(\delta_b;\beta_a)}_a, (v,(\delta_b;\beta_a)) \vDash K_aA\) and \(\mathcal{M}^{v,(\delta_b;\beta_a)}_a \vDash e^{\delta_b;\beta_a}_a\) and \(\mathcal{M}^{v,\delta_b}_b \vDash e^{\delta_b}_b\).
The first two conjuncts are easily checked, as \(pre(\delta_b)= A\) and \(pre(\beta_a) = d'\), which respectively hold in \(\mathcal{M}_b^v,v\) of 2 (left), and in \(\mathcal{M}^{v,\delta_b}_a, (v,\delta_b)\) of 3 (left). The third conjunct is evaluated in the model \(\mathcal{M}^{v,(\delta_b;\beta_a)}_a\) of 4 (second from the left)), resulting from applying \(\delta_b\) followed by \(\beta_a\), where \(K_a A\) holds as in every world that is \(a\)-accessible, \(A\) holds. Finally, the last two conjuncts hold as \(\mathbb{E}_b(\mathcal{M}^\delta_b) \geq \mathbb{E}_b(\mathcal{M}^\gamma_b)\) and \(\mathbb{E}_a(\mathcal{M}^{\delta;\beta}_a) \geq \mathbb{E}_a(\mathcal{M}^{\delta;\alpha}_a)\).
Similarly, it can be checked that \(\mathcal{M}_b^v \not\vDash O_b ( U,\gamma_b | O_a ( U',\beta_a |K_aA))\), which means that \(b\) should not avoid informing \(a\), as \(a\) would perform \(\beta_a\) if \(a\) knew \(A\) (as \(b\) does). What makes the formula fail is the fact that \(\mathcal{M}^{v,\gamma_b}_a, (v,\gamma_b) \vDash\langle U',\beta_a\rangle K_aA\) does not hold, as \(\mathcal{M}^{v,(\gamma_b;\beta_a)}_a, (v,(\gamma_b;\beta_a)) \not\vDash K_aA\), since action \(\gamma_b\) does not enforce \(A\) in \(a\)’s submodel.
This paper introduced Deontic Action Model Logic (DAML), a novel multi-agent deontic modal logic that integrates the dynamic machinery of action model logic with a value-based evaluation of actions. From a knowledge representation perspective, DAML offers a structured way to encode and reason about normative information, epistemic uncertainty, and action effects within a unified logical framework. This makes it suitable for modeling and analyzing decision problems faced by autonomous agents operating in uncertain and normatively constrained domains. We established soundness and completeness for the logic and illustrated its expressive power through applications to deontic scenarios.
There are several promising directions for future work: On the epistemic side, introducing explicit probability measures over worlds would yield a more fine-grained notion of expected deontic value, while replacing the knowledge operator with a graded belief operator would allow the framework to capture varying degrees of uncertainty about states of affairs and action outcomes. On the deontic side, alternative ways of computing expectation functions could support additional modalities, such as permissions and prohibitions. Finally, enriching the action language with more expressive constructs, including non-deterministic choice, would enable the study of conflicting obligations and more sophisticated forms of decision-making in dynamic multi-agent settings.
This work was supported by the Austrian Science Fund (FWF) project A Logical Framework for Graded Deontic Reasoning [10.55776/PAT2141924] ().
I am thankful to Christian Fermüller, Xavier Parent and Henri Thölke for the multiple illuminating discussions.
We return to the role of the precondition function in [rem:actual].↩︎
We assume that each world in a graded Kripke model has an "objective" desirability value, meaning that all agents have the same opinion about these values. This assumption can easily be relaxed e.g. by using weaker logics than S5. Exploring alternative ways to model subjective desirability values is left for future work.↩︎
We aim at introducing a probability value to each world in future work.↩︎
Naturally, using an expectation function is only one way to model agent’s attitudes towards desirability values. Exploring other attitudes is left for future work.↩︎
Here \(W^{\alpha_i}\) and \(W^{\beta_i}\) are the domains of the action generated submodels from actions \(\alpha_i\) and \(\beta_i\). Recall that each \(U\) represents a decision point that collects only the actions of a single agent \(i \in \Pi\). Additionally, using \(\geq\) implies that there is always an action \(\alpha_i \in E\) leading to the highest expectation value↩︎
Recall that it is not possible to have an expectation atom for no action, as we assumed both \(\mathcal{A}\ne \varnothing\) and \(E \ne \varnothing\).↩︎
Because some actions might lead to equally good expected deontic value for the corresponding action-generated submodels, more than one ought formula might be true for an agent at a decision point. Having multiple (and often conflicting) obligations is an expected feature of deontic logics [3], [5] and exploring resolution mechanisms is outside the scope of this work.↩︎
This model can be thought of a game-tree in game theoretic settings. Exploring the connections to game theory is left for future work.↩︎